Tests authored
- CISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.
- CISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.
- MT.1001At least one Conditional Access policy is configured with device compliance.
- MT.1003At least one Conditional Access policy is configured with All Apps.
- MT.1004At least one Conditional Access policy is configured with All Apps and All Users.
- MT.1021Security Defaults are enabled.
- MT.1034MT.1034.$($EmergencyAccessUsers.IndexOf($_)): Emergency access users should not be blocked ($($_.userPrincipalName))
- MT.1038Conditional Access policies should not include or exclude deleted groups.
- MT.1055Microsoft 365 Group (and Team) creation should be restricted to approved users.
Also contributed to
- AD-CFG-01Tombstone lifetime configuration should be retrievable
- AD-CFG-02dSHeuristics count should be retrievable
- AD-CFG-03SPN mappings should be retrievable
- AD-CFG-04Optional features count should be retrievable
- AD-CFG-05Recycle bin enabled paths should be retrievable
- AD-CFG-06LDAP query policy count should be retrievable
- AD-CFG-07Default query policy should be retrievable
- AD-CFG-08AuthN policy container count should be retrievable
- AD-CFG-09AD activation objects count should be retrievable
- AD-CFG-10Well-known security principals count should be retrievable
- AD-CFG-11Registered DHCP servers count should be retrievable
- AD-CFG-12Enterprise CA count should be retrievable
- AD-CFG-13Certificate templates count should be retrievable
- AD-CFG-14Enrollment templates count should be retrievable
- AD-CFG-15Enrollment CA certificate details should be retrievable
- AD-CFG-16Trusted root CA count should be retrievable
- AD-CFG-17Trusted root CA details should be retrievable
- AD-CFG-18Intermediate CA count should be retrievable
- AD-CFG-19Intermediate CA details should be retrievable
- AD-CFG-20CRL distribution points count should be retrievable
- AD-CFG-21NTAuth certificates count should be retrievable
- AD-CFG-22KDS root keys count should be retrievable
- AD-CFG-23SMTP site links count should be retrievable
- AD-CFG-24IP site links count should be retrievable
- AD-COMP-01Computer disabled count should be retrievable
- AD-COMP-02Computer dormant count should be retrievable
- AD-COMP-03Computer CreatorSid count should be retrievable
- AD-COMP-04Computer non-standard primary group count should be retrievable
- AD-COMP-05Computer SID History count should be retrievable
- AD-COMP-06Computer default container count should be retrievable
- AD-COMP-07Computer OU count should be retrievable
- AD-COMP-08Computer per OU average should be retrievable
- AD-COMP-09Computer delegation count should be retrievable
- AD-COMP-10Computer delegation details should be retrievable
- AD-DACL-01Distinct DACL object count should be retrievable
- AD-DACL-02OU DACL entry count should be retrievable
- AD-DACL-03Conflict object count should be retrievable
- AD-DACL-04Conflict object details should be retrievable
- AD-DACL-05Deny ACE count should be retrievable
- AD-DACL-06Deny ACE details should be retrievable
- AD-DACL-07Distinct DACL identity count should be retrievable
- AD-DACL-08DACL ACE distribution per identity should be retrievable
- AD-DACL-09Privileged allow ACE count should be retrievable
- AD-DACL-10Privileged allow ACE details should be retrievable
- AD-DACL-11Privileged extended right count should be retrievable
- AD-DACL-12Privileged extended right details should be retrievable
- AD-DACL-13Privileged extended right identities should be retrievable
- AD-DACL-14Non-inherited ACE count should be retrievable
- AD-DACL-15Unresolved SID count should be retrievable
- AD-DACL-16Unresolved SID details should be retrievable
- AD-DACL-17Inherited object type count should be retrievable
- AD-DACL-18Inherited object type details should be retrievable
- AD-DC-01DC site coverage count should be retrievable
- AD-DC-02SMBv1 should be disabled on all domain controllers
- AD-DC-03SMBv3.1.1 enabled count should be retrievable
- AD-DC-04SMB signing should be enabled on all domain controllers
- AD-DC-05DCs with all FSMO roles count should be retrievable
- AD-DC-06FSMO role holder details should be retrievable
- AD-DC-07DC operating system count should be retrievable
- AD-DC-08DC operating system details should be retrievable
- AD-DCD-01DC non-standard LDAP port count should be retrievable
- AD-DCD-02DC non-standard LDAPS port count should be retrievable
- AD-DCD-03Read-only domain controller count should be retrievable
- AD-DCD-04Non-Global Catalog DC count should be retrievable
- AD-DCOMP-01Computers with unconstrained delegation count should be investigated
- AD-DCOMP-02Non-DC computers should not have unconstrained delegation
- AD-DCOMP-03Non-DC computers with constrained delegation count should be investigated
- AD-DCOMP-04Computer operating system count should be retrievable
- AD-DCOMP-05Computer operating system details should be retrievable
- AD-DCOMP-06Stale enabled computer count should be retrievable
- AD-DCOMP-07Computer DNS host name count should be retrievable
- AD-DCOMP-08Computer DNS zone count should be retrievable
- AD-DCOMP-09Computer DNS zone details should be retrievable
- AD-DFSR-01All domain controllers should have DFS-R subscriptions
- AD-DNS-01DNS zone count should be retrievable
- AD-DNS-02Zones with only SOA/NS records should be retrievable
- AD-DNS-03Root servers with incorrect IPs should be retrievable
- AD-DNS-04Root server incorrect IP details should be retrievable
- AD-DNS-05Dynamic DNS record count should be retrievable
- AD-DNS-06Zones with non-default records should be retrievable
- AD-DNS-07Zone record count details should be retrievable
- AD-DNS-08Zone delegation count should be retrievable
- AD-DNS-09Zone delegation details should be retrievable
- AD-DNS-10SOA record details should be retrievable
- AD-DNS-11AD DS SRV record count should be retrievable
- AD-DNS-12AD DS SRV record details should be retrievable
- AD-DNS-13DNSSEC record count should be retrievable
- AD-DNS-14Empty zone count should be retrievable
- AD-DNS-15Duplicate zone count should be retrievable
- AD-DNS-16Reverse lookup zone count should be retrievable
- AD-DNS-17Non-standard zone count should be retrievable
- AD-DNS-18Reverse zone network count should be retrievable
- AD-DNS-19Reverse zone network details should be retrievable
- AD-DOM-01Domain functional level should be retrievable
- AD-DOM-02Machine account quota should be retrievable
- AD-DOM-03Domain controller count should be retrievable
- AD-DOM-04RIDs remaining should be retrievable
- AD-DOM-05Domain name standard compliance should be retrievable
- AD-DOM-06Domain name non-standard details should be retrievable
- AD-DOM-07NetBIOS name standard compliance should be retrievable
- AD-DOM-08NetBIOS name non-standard details should be retrievable
- AD-DOMS-01Allowed DNS suffixes count should be retrievable
- AD-FEAT-01Optional feature count should be retrievable
- AD-FEAT-02Optional feature enabled details should be retrievable
- AD-FGPP-01Fine-grained password policy count should be retrievable
- AD-FGPP-02Fine-grained password policy value count should be retrievable
- AD-FGPP-03Fine-grained password policy setting counts should be retrievable
- AD-FGPP-04Fine-grained password policy application targets should be retrievable
- AD-FOR-01Forest functional level should be retrievable
- AD-FOR-02Forest domain count should be retrievable
- AD-FOR-03Tombstone lifetime should be retrievable
- AD-FOR-04Recycle Bin status should be retrievable
- AD-FORS-01UPN suffixes count should be retrievable
- AD-FORS-02UPN suffixes details should be retrievable
- AD-FORS-03SPN suffixes count should be retrievable
- AD-FORS-04Cross-forest references count should be retrievable
- AD-GCHG-01Average group membership changes per year should be retrievable
- AD-GMC-01Distinct groups with members count should be retrievable
- AD-GMC-02Distinct account types of members count should be retrievable
- AD-GMC-03Member account types breakdown should be retrievable
- AD-GMC-04Trust members count should be retrievable
- AD-GMC-05Trust members details by group should be retrievable
- AD-GMC-06Foreign SID principals count should be retrievable
- AD-GMC-07Foreign SID details by domain should be retrievable
- AD-GMC-08Empty non-privileged group count should be retrievable
- AD-GMC-09Empty non-privileged group details should be retrievable
- AD-GMC-10Privileged groups with members count should be retrievable
- AD-GMC-11Privileged groups with members details should be retrievable
- AD-GPO-01GPO total count should be retrievable
- AD-GPO-02GPO created before 2020 count should be retrievable
- AD-GPO-03GPO stale-before-2020 count should be retrievable
- AD-GPO-04Unlinked GPO count should be compliant
- AD-GPO-05GPO unlinked details should be compliant
- AD-GPOL-01GPO linked count should be retrievable
- AD-GPOL-02Disabled GPO link count should be retrievable
- AD-GPOL-03GPO unlinked target count should be compliant
- AD-GPOL-04Enforced GPO link count should be retrievable
- AD-GPOL-05GPO blocked inheritance count should be compliant
- AD-GPOL-06GPO linked OU count should be retrievable
- AD-GPOREP-12GPO disabled link count should be retrievable
- AD-GRP-01Group AdminCount should be retrievable
- AD-GRP-02Groups in container objects count should be retrievable
- AD-GRP-03Stale groups count should be retrievable
- AD-GRP-04Groups with manager count should be retrievable
- AD-GRP-05Group SID History count should be retrievable
- AD-GRP-06Distribution group count should be retrievable
- AD-GRP-07Security group count should be retrievable
- AD-GRP-08Domain local group count should be retrievable
- AD-GRP-09Global group count should be retrievable
- AD-GRP-10Universal group count should be retrievable
- AD-KRBTGT-01KRBTGT password last set should be retrievable
- AD-KRBTGT-02KRBTGT last logon should be retrievable
- AD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)
- AD-MSA-01Managed service account count should be retrievable
- AD-OU-01OU overlapping name count should be retrievable
- AD-OU-02OU at domain root count should be retrievable
- AD-OU-03OU stale count should be retrievable
- AD-OU-04OU empty count should be retrievable
- AD-OU-05OU empty details should be retrievable
- AD-PRINT-01Printer total count should be retrievable
- AD-PWDPOL-01Password history count should be retrievable
- AD-PWDPOL-02Password maximum age should be retrievable
- AD-PWDPOL-03Password minimum length should be retrievable
- AD-PWDPOL-04Password complexity requirement should be retrievable
- AD-PWDPOL-05Password reversible encryption status should be retrievable
- AD-PWDPOL-06Account lockout duration should be retrievable
- AD-PWDPOL-07Account lockout threshold should be retrievable
- AD-REPL-01No replication connections should be disabled
- AD-REPL-02Non-auto replication connection count should be retrievable
- AD-ROOTDSE-01Supported SASL mechanism count should be retrievable
- AD-ROOTDSE-02Supported SASL mechanism details should be retrievable
- AD-ROOTDSE-03Root DSE should be synchronized
- AD-SCH-01Schema modification year count should be retrievable
- AD-SCH-02Schema modification year details should be retrievable
- AD-SCH-03Schema version entry count should be retrievable
- AD-SCH-04Schema version details should be retrievable
- AD-SCH-05LAPS should be installed in Active Directory
- AD-SITE-01Site total count should be retrievable
- AD-SITE-02Sites without domain controllers count should be retrievable
- AD-SITE-03Sites without domain controllers details should be retrievable
- AD-SITE-04Sites without subnet associations count should be retrievable
- AD-SITE-05Sites without subnet associations details should be retrievable
- AD-SPN-01Computer SPN service class count should be retrievable
- AD-SPN-02Computer SPN service class usage should be retrievable
- AD-SPN-03Computer SPN unknown service class count should be retrievable
- AD-SPN-04Computer SPN unknown service class details should be retrievable
- AD-SPN-05Computer SPN non-FQDN hosts should be retrievable
- AD-SPN-06User SPN total count should be retrievable
- AD-SPN-07User SPN service class count should be retrievable
- AD-SPN-08User SPN service class usage should be retrievable
- AD-SPN-09User SPN unknown service class count should be retrievable
- AD-SPN-10User SPN unknown service class details should be retrievable
- AD-SPN-11User SPN non-FQDN hosts should be retrievable
- AD-SPN-12User SPN domain admin count should be retrievable
- AD-SPN-13User SPN domain admin details should be retrievable
- AD-SUB-01Subnet total count should be retrievable
- AD-SUB-02Sites with subnet associations count should be retrievable
- AD-SUB-03Catch-all subnets count should be retrievable
- AD-SUB-04IPv6 subnets count should be retrievable
- AD-SUB-05IPv6 catch-all subnets count should be retrievable
- AD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievable
- AD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievable
- AD-SUB-08Distinct first octets count should be retrievable
- AD-SUB-09Distinct first two octets (/16 networks) count should be retrievable
- AD-SUB-10Distinct first three octets (/24 networks) count should be retrievable
- AD-SUB-11Subnets without site associations count should be retrievable
- AD-TRUST-01Trust total count should be retrievable
- AD-TRUST-02Trust inter-forest count should be retrievable
- AD-TRUST-03Trust quarantined count should be investigated
- AD-TRUST-04Trusts should not have weak SID filtering
- AD-TRUST-05Trust configuration details should be retrievable
- AD-TRUST-06Trust stale count should be retrievable
- AD-TRUST-07Trust stale details should be retrievable
- AD-USER-01Disabled user count should be retrievable
- AD-USER-02Dormant enabled user count should be retrievable
- AD-USER-03Non-expiring password user count should be retrievable
- AD-USER-04Reversible encryption user count should be retrievable
- AD-USER-05Delegation-enabled user count should be retrievable
- AD-USER-06DES-only Kerberos user count should be retrievable
- AD-USER-07No pre-authentication user count should be retrievable
- AD-USER-08Never-logged-in enabled user count should be retrievable
- AD-USER-09Password-not-required user count should be retrievable
- AD-USER-10Workstation-restricted user count should be retrievable
- AD-USER-11User AdminCount count should be retrievable
- AD-USER-12User non-standard primary group count should be retrievable
- AD-USER-13User SID History count should be retrievable
- AD-USER-14User SPN count should be retrievable
- AD-USER-15User manager count should be retrievable
- AD-USER-16User home directory count should be retrievable
- AD-USER-17User profile path count should be retrievable
- AD-USER-18User script path count should be retrievable
- AD-USER-19User in container count should be retrievable
- AD-USER-20Known service account count should be retrievable
- AD-USER-21Known service account details should be retrievable
- AD-USER-22Built-in administrator account count should be retrievable
- AD-USER-23Enabled built-in administrator details should be retrievable
- AD-USER-24Built-in administrator last logon details should be retrievable
- AD-USER-25Built-in administrator password age details should be retrievable
- AD-USER-26Honey pot user count should be retrievable
- AD-USER-27Honey pot user details should be retrievable
- AD-USER-28User delegation configured count should be retrievable
- AD-USER-29No users should be configured for unconstrained delegation
- CIS.M365.1.1.1(L1) Ensure Administrative accounts are cloud-only
- CIS.M365.1.1.3(L1) Ensure that between two and four global admins are designated
- CIS.M365.1.2.1(L2) Ensure that only organizationally managed/approved public groups exist
- CIS.M365.1.2.2(L1) Ensure sign-in to shared mailboxes is blocked
- CIS.M365.1.3.1(L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'
- CIS.M365.1.3.3(L2) Ensure 'External sharing' of calendars is not available
- CIS.M365.1.3.5(L1) Ensure internal phishing protection for Forms is enabled
- CIS.M365.1.3.7(L2) Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'
- CIS.M365.4.1(L1) Ensure devices without a compliance policy are marked 'not compliant'
- CIS.M365.5.1.2.2(L1) Ensure users cannot register applications
- CIS.M365.5.1.2.3(L1) Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'
- CIS.M365.5.1.5.1(L2) Ensure user consent to apps accessing company data on their behalf is not allowed
- CIS.M365.5.1.5.2(L1) Ensure the admin consent workflow is enabled
- CIS.M365.5.1.6.2(L1) Ensure that guest user access is restricted
- CIS.M365.5.2.3.5(L1) Ensure weak authentication methods are disabled
- CIS.M365.6.5.3(L2) Ensure additional storage providers are restricted in Outlook on the web
- CIS.M365.8.1.1(L2) Ensure external file sharing in Teams is enabled for only approved cloud storage services
- CIS.M365.8.2.2(L1) Ensure communication with unmanaged Teams users is disabled
- CIS.M365.8.2.3(L1) Ensure external Teams users cannot initiate conversations
- CIS.M365.8.4.1(L1) Ensure app permission policies are configured
- CIS.M365.8.5.3(L1) Ensure only people in my org can bypass the lobby
- CIS.M365.8.6.1(L1) Ensure users can report security concerns in Teams
- CISA.MS.AAD.1.1Legacy authentication SHALL be blocked.
- CISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.
- CISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.
- CISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.
- CISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.
- CISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.
- CISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.
- CISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.
- CISA.MS.AAD.5.4Group owners SHALL NOT be allowed to consent to applications.
- CISA.MS.AAD.6.1User passwords SHALL NOT expire.
- CISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.
- CISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.
- CISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.
- CISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Azure AD directory objects.
- CISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.
- CISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.
- CISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.
- CISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.
- CISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.
- CISA.MS.EXO.7.1External sender warnings SHALL be implemented.
- CISA.MS.EXO.8.1A DLP solution SHALL be used.
- CISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.
- CISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.
- CISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.
- CISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.
- CISA.MS.EXO.17.2Microsoft Purview Audit (Premium) logging SHALL be enabled.
- CISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.
- EIDSCA.AF01Authentication Method - FIDO2 security key - State.
- EIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.
- EIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.
- EIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.
- EIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.
- EIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.
- EIDSCA.AG01Authentication Method - General Settings - Manage migration.
- EIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.
- EIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.
- EIDSCA.AM01Authentication Method - Microsoft Authenticator - State.
- EIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.
- EIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.
- EIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.
- EIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.
- EIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.
- EIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.
- EIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.
- EIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.
- EIDSCA.AP04Default Authorization Settings - Guest invite restrictions.
- EIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.
- EIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.
- EIDSCA.AP07Default Authorization Settings - Guest user access.
- EIDSCA.AP08Default Authorization Settings - User consent policy assigned for applications.
- EIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.
- EIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.
- EIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.
- EIDSCA.AS04Authentication Method - SMS - Use for sign-in.
- EIDSCA.AT01Authentication Method - Temporary Access Pass - State.
- EIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.
- EIDSCA.AV01Authentication Method - Voice call - State.
- EIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.
- EIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.
- EIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.
- EIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.
- EIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.
- EIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.
- EIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).
- EIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.
- EIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.
- EIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.
- EIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.
- EIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.
- EIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.
- EIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.
- MT.1002App management restrictions on applications and service principals is configured and enabled.
- MT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.
- MT.1006At least one Conditional Access policy is configured to require MFA for admins.
- MT.1007At least one Conditional Access policy is configured to require MFA for all users.
- MT.1008At least one Conditional Access policy is configured to require MFA for Azure management.
- MT.1009At least one Conditional Access policy is configured to block other legacy authentication.
- MT.1010At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.
- MT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.
- MT.1012At least one Conditional Access policy is configured to require MFA for risky sign-ins.
- MT.1013At least one Conditional Access policy is configured to require new password when user risk is high.
- MT.1014At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.
- MT.1015At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.
- MT.1016At least one Conditional Access policy is configured to require MFA for guest access.
- MT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.
- MT.1018At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.
- MT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.
- MT.1020All Conditional Access policies are configured to exclude directory synchronization accounts or do not scope them.
- MT.1022All users utilizing a P1 license should be licensed.
- MT.1023All users utilizing a P2 license should be licensed.
- MT.1024MT.1024.$($RecommendationId -replace '^[^_]+_', ''): $($_.displayName)
- MT.1025No external user with permanent role assignment on Control Plane.
- MT.1026No hybrid user with permanent role assignment on Control Plane.
- MT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.
- MT.1028No user with mailbox and permanent role assignment on Control Plane.
- MT.1029Stale accounts are not assigned to privileged roles.
- MT.1030Eligible role assignments on Control Plane are in use by administrators.
- MT.1031Privileged role on Control Plane are managed by PIM only.
- MT.1032Limited number of Global Admins are assigned.
- MT.1033MT.1033.$($RegularUsers.IndexOf($_)): User should be blocked from using legacy authentication ($($_.userPrincipalName))
- MT.1037Only users with Presenter role are allowed to present in Teams meetings
- MT.1042Restrict dial-in users from bypassing a meeting lobby
- MT.1045Only invited users should be automatically admitted to Teams meetings
- MT.1046Restrict anonymous users from joining meetings
- MT.1047Restrict anonymous users from starting Teams meetings
- MT.1048Limit external participants from having control in a Teams meeting
- MT.1049Conditional Access policies for User Risk and Sign-in Risk should be configured separately.
- MT.1050Apps with high-risk permissions having a direct path to Global Administrator
- MT.1051Apps with high-risk permissions having an indirect path to Global Administrator
- MT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.
- MT.1053Ensure intune device clean-up rule is configured
- MT.1054Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'
- MT.1056Ensure that no person has permanent access to all Azure subscriptions at the root scope
- MT.1057Ensure Microsoft 365 Group (and Team) expiration is configured to notify users.
- MT.1058Ensure Microsoft 365 Group (and Team) expiration is configured to auto-expire groups.
- MT.1063All app registration owners should have MFA registered
- MT.1067Authentication methods policies should not reference deleted groups.
- MT.1070Restrict device join to selected users/groups or none.
- MT.1075Third Party Entra Apps should only have explicitly assigned users instead of All Users.
- MT.1077App registrations with privileged API permissions should not have owners
- MT.1078App registrations with highly privileged directory roles should not have owners
- MT.1079Privileged API permissions on service principals should not remain unused
- MT.1080Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints
- MT.1081Hybrid users should not be assigned Entra ID role assignments
- MT.1084Seamless Single SignOn should be disabled for all domains in EntraID Connect servers.
- MT.1094Apple Volume Purchase Program Tokens should be valid for more than 30 days
- MT.1096Intune Multi Admin approval should be configured
- MT.1097Certificate Connectors should be healthy and running supported versions
- MT.1106Catalog resources must have valid roles (no stale app roles or deleted SPNs)
- MT.1107Access packages and catalogs should not reference deleted groups
- MT.1108Access packages should not have inactive or orphaned assignment policies
- MT.1109Access package approval workflows must have valid approvers
- MT.1110No catalog should contain resources without any associated access packages
- MT.1111High privileged user should be linked to an identity
- MT.1112Privileged user accounts should not remain enabled when the linked primary account is disabled
- MT.1113AI agents should not be shared with broad access control policies
- MT.1114AI agents should require user authentication
- MT.1115AI agents should not have risky HTTP configurations
- MT.1116AI agents should not send email with AI-controlled inputs
- MT.1117Published AI agents should not be dormant
- MT.1118AI agents should avoid using author (maker) authentication for tools
- MT.1119AI agents should not have hard-coded credentials in topics
- MT.1120AI agents should not use MCP server tools without review
- MT.1121AI agents with generative orchestration should have custom instructions
- MT.1122AI agents should not have orphaned ownership
- MT.1173Sensitivity labels are published for files used by Microsoft 365 Copilot
- MT.1181Conditional Access policy is present that blocks high agent risk signins
- MT.1186High-privilege first-party Entra Apps should only have explicitly assigned users instead of All Users.
- MT.1187The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled
- MT.1188Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device
- MT.1189Groups assigned to Global Secure Access traffic forwarding profiles should not be nested
- MT.1190Entra Private Access applications should not use the Default connector group
- MT.1191Break-glass accounts should be excluded from the Compliant Network Conditional Access policy
- MT.1192Groups assigned to Entra Private Access applications should not be nested
- MT.1193Entra Private Access application segments should avoid broad or risky destinations
- MT.1194The baseline Global Secure Access security profile should enforce a threat-intelligence floor
- MT.1195The Quick Access app should not be subject to a sign-in frequency Conditional Access control
- MT.1198App registration certificates should not have excessive validity periods.
- MT.1199App registration credentials should not be expired or expiring soon.
- ORCA.100Bulk Complaint Level threshold is between 4 and 6.
- ORCA.101Bulk is marked as spam.
- ORCA.102Advanced Spam filter options are turned off.
- ORCA.103Outbound spam filter policy settings configured.
- ORCA.104High Confidence Phish action set to Quarantine message.
- ORCA.105Safe Links Synchronous URL detonation is enabled.
- ORCA.106Quarantine retention period is 30 days.
- ORCA.107End-user spam notification is enabled.
- ORCA.108DKIM signing is set up for all your custom domains.
- ORCA.108.1DNS Records have been set up to support DKIM.
- ORCA.109Senders are not being allow listed in an unsafe manner.
- ORCA.110Internal Sender notifications are disabled.
- ORCA.111Anti-phishing policy exists and EnableUnauthenticatedSender is true.
- ORCA.112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.
- ORCA.113AllowClickThrough is disabled in Safe Links policies.
- ORCA.114No IP Allow Lists have been configured.
- ORCA.115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.
- ORCA.116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.
- ORCA.118.1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.
- ORCA.118.2Domains are not being allow listed in an unsafe manner in Transport Rules.
- ORCA.118.3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.
- ORCA.118.4Your own domains are not being allow listed in an unsafe manner in Transport Rules.
- ORCA.119Similar Domains Safety Tips is enabled.
- ORCA.120.1Zero Hour Autopurge Enabled for Phish.
- ORCA.120.2Zero Hour Autopurge Enabled for Malware.
- ORCA.120.3Zero Hour Autopurge Enabled for Spam.
- ORCA.121Supported filter policy action used.
- ORCA.123Unusual Characters Safety Tips is enabled.
- ORCA.124Safe attachments unknown malware response set to block messages.
- ORCA.139Spam action set to move message to junk mail folder or quarantine.
- ORCA.140High Confidence Spam action set to Quarantine message.
- ORCA.141Bulk action set to Move message to Junk Email Folder.
- ORCA.142Phish action set to Quarantine message.
- ORCA.143Safety Tips are enabled.
- ORCA.156Safe Links Policies are tracking when user clicks on safe links.
- ORCA.158Safe Attachments is enabled for SharePoint and Teams.
- ORCA.179Safe Links is enabled intra-organization.
- ORCA.180Anti-phishing policy exists and EnableSpoofIntelligence is true.
- ORCA.189Safe Attachments is not bypassed.
- ORCA.189.2Safe Links is not bypassed.
- ORCA.205Common attachment type filter is enabled.
- ORCA.220Advanced Phish filter Threshold level is adequate.
- ORCA.221Mailbox intelligence is enabled in anti-phishing policies.
- ORCA.222Domain Impersonation action is set to move to Quarantine.
- ORCA.223User impersonation action is set to move to Quarantine.
- ORCA.224Similar Users Safety Tips is enabled.
- ORCA.225Safe Documents is enabled for Office clients.
- ORCA.226Each domain has a Safe Link policy applied to it.
- ORCA.227Each domain has a Safe Attachments policy applied to it.
- ORCA.228No trusted senders in Anti-phishing policy.
- ORCA.229No trusted domains in Anti-phishing policy.
- ORCA.230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.
- ORCA.231Each domain has a anti-spam policy applied to it, or the default policy is being used.
- ORCA.232Each domain has a malware filter policy applied to it, or the default policy is being used.
- ORCA.233Domains are pointed directly at EOP or enhanced filtering is used.
- ORCA.233.1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.
- ORCA.234Click through is disabled for Safe Documents.
- ORCA.235SPF records is set up for all your custom domains.
- ORCA.236Safe Links is enabled for emails.
- ORCA.237Safe Links is enabled for teams messages.
- ORCA.238Safe Links is enabled for office documents.
- ORCA.239No exclusions for the built-in protection policies.
- ORCA.240Outlook is configured to display external tags for external emails.
- ORCA.241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.
- ORCA.242Important protection alerts responsible for AIR activities are enabled.
- ORCA.243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.
- ORCA.244Policies are configured to honor sending domains DMARC.